Payment Processor Reviewing Med Spa Account: What to Do Next

If a payment processor is reviewing your med spa account, start with the notice, response deadline, merchant agreement, and requested records. There is no universal federal rule requiring every med spa account to be reviewed, frozen, reserved, or terminated. The processor, acquirer, payment facilitator, and applicable contract usually determine the reason and next step.

Payment processor reviewing med spa account at a glance

Why is my payment processor reviewing my med spa account?

A processor may review a med spa account because of underwriting, transaction monitoring, dispute exposure, documentation questions, product or service eligibility, or suspected misrepresentation. The approved federal sources do not establish Square’s internal criteria or a mandatory med spa review checklist.

Review the notice and compare the processor’s records with the business operating today. Explain whether transactions involve professional services, memberships, treatment plans, products, prescriptions, or third-party fulfillment. Those distinctions can affect how the account is understood, but a review does not by itself prove that the business violated a rule.

A processor review is not the same as a clinical, licensing, legal, Medicare, or Medicaid determination. Treat it as a fact-and-documentation event until the processor identifies a specific concern.

What documents does a processor need from an aesthetics clinic?

A processor may request ownership and business-identification documents, medical or professional licenses, service descriptions, website and advertising policies, refund and cancellation terms, recurring-billing consent, fulfillment records, and transaction, refund, or dispute records. These are operational examples, not a federal checklist.

Prepare a response folder with:

• the review notice and deadline;
• the legal business name, ownership information, and operating address;
• current service-location and licensing information;
• a concise description of services, memberships, products, prescriptions, and fulfillment relationships;
• website, checkout, privacy, refund, and cancellation policies;
• patient-consent or recurring-billing records when requested;
• invoices, transaction records, refunds, disputes, appointment records, or delivery records relevant to the request.

Send accurate, consistent records. Do not alter descriptors, split transactions, route payments through another merchant account, or misstate what the business sells while the review is open.

Can recurring memberships or treatment plans create payment concerns?

Yes. Recurring memberships, subscriptions, treatment plans, and other negative-option features should be reviewed against the Restore Online Shoppers’ Confidence Act, which requires clear disclosure of material terms, express informed consent, and a simple way to stop recurring charges. The FTC’s 2024 amendments to its Negative Option Rule are not in force; the U.S. Court of Appeals for the Eighth Circuit vacated them on July 8, 2025.

The rule took effect January 14, 2025, with the compliance date for §§ 425.4–425.6 on May 14, 2025. Among other requirements, it addresses material misrepresentations, clear and conspicuous disclosure of material terms before billing information is collected, express informed consent before charging, and a simple cancellation mechanism that immediately stops recurring charges.

A processor may ask for enrollment language, authorization records, and cancellation-workflow evidence. The FTC rule does not itself create a processor-review procedure. State automatic-renewal, consumer-protection, medical-practice, and subscription laws may add requirements.

Can reviews, testimonials, or health claims affect an account review?

Yes, potentially. The FTC’s Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 C.F.R. Part 465, addresses deceptive reviews and testimonials, including fake reviews, reviews from people who did not use the service, sentiment-conditioned review incentives, undisclosed insider reviews, fake independent-review websites, certain suppression practices, and fake social-media influence indicators.

The rule’s Federal Register date was August 14, 2024, and its effective date was October 21, 2024. Keep records showing that testimonials reflect real customer experiences and that incentives are not conditioned on positive sentiment. Before-and-after images, guaranteed-result language, and health-related representations can also create risk if misleading.

A processor review does not decide whether an advertisement is lawful. State advertising, professional-board, consumer-fraud, medical-practice, and testimonial rules may be more specific.

Does HIPAA apply to my payment and scheduling systems?

It may, depending on the entity, vendor relationship, and data flow. Payment-card data is not automatically PHI under the approved sources. A HIPAA covered entity is generally a health plan, healthcare clearinghouse, or healthcare provider conducting covered electronic transactions, while some vendors may be business associates.

Map whether the payment page, booking system, CRM, analytics tool, or processor receives names linked to appointments, treatment details, diagnoses, prescription information, portal credentials, or other individually identifiable health information. HHS explains that information handled by a covered entity’s website, app, or tracking technology may be PHI when it relates to health and identifies an individual.

If unsecured PHI is breached, the HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–414, generally requires notice without unreasonable delay and no later than 60 days after discovery. Business associates must notify the covered entity without unreasonable delay and no later than 60 days after discovery.

A non-HIPAA health app or direct-to-consumer platform may instead fall under the FTC’s Health Breach Notification Rule, 16 C.F.R. Part 318. Its 2024 amendments became effective July 29, 2024. In September 2026, the FTC withdrew an obsolete 2021 policy statement; that withdrawal does not eliminate the current rule.

Can telehealth billing or state licensing affect the review?

Yes. Inconsistent descriptions of telehealth services, unsupported charges, duplicate billing, inadequate documentation, or unclear patient charges can create payment-processing and healthcare-compliance concerns. HHS states that telehealth reimbursement varies among Medicare, Medicaid, and private insurers; Medicaid rules vary by state, and private-insurance requirements vary by payer and jurisdiction.

CMS/HHS guidance emphasizes accurate coding, appropriate modality, correct place-of-service reporting, eligible sites, and adequate documentation for Medicare telehealth billing. A processor review is not a Medicare or Medicaid audit. HHS OIG’s telefraud warning concerns schemes involving payments for medical reviews, consultations, assessments, or chart reviews; it is an enforcement warning, not a universal prohibition on telehealth business models.

State-specific review remains necessary for ownership, corporate-practice restrictions, delegation and supervision, provider licensure, facility or pharmacy licensing, automatic renewal, privacy, breach notification, advertising, testimonials, before-and-after claims, sales tax, and shipped or compounded products. No state rule should be assumed without checking the relevant official agency or professional board.

What do I do if my med spa account is under review?

Follow this sequence:

1. 1Save the notice: Identify the response deadline and the transactions or services mentioned.
2. 2Describe the business accurately: Separate services, memberships, products, prescriptions, and third-party fulfillment.
3. 3Reconcile account information: Compare the processor profile with the legal entity, owners, locations, website, checkout language, and bank records.
4. 4Gather requested records: Include licenses, ownership records, policies, consent records, invoices, refunds, disputes, appointment records, or fulfillment evidence.
5. 5Ask whether processing may continue: Confirm which transactions, payouts, holds, or reserves are affected.
6. 6Review the agreement: Ask whether any hold or reserve is based on a specific merchant-agreement provision and request the appeal or remediation process.
7. 7Preserve communications: Do not alter descriptors, route payments through another account, split transactions, or misstate the business model.
8. 8Escalate specialized issues: Obtain counsel or compliance advice if the review involves suspected fraud, prescription sales, unlicensed practice, patient-data exposure, or threatened termination.

Request an emergency processing review

MDLaunchr, the brand behind WhiteLabelClinic.com, is a white-label telehealth infrastructure platform—not a processor, regulator, law firm, or guarantor of approval. It helps qualified businesses evaluate and coordinate technology, operational, compliance, clinical-network, and fulfillment relationships involved in launching telehealth services.

Questions to ask your processor

1. 1What is the scope of this review, and what transaction types are being evaluated?
2. 2What is the response deadline, and may we continue processing while the review is open?
3. 3Which transactions, payouts, holds, or reserves are affected?
4. 4Is any hold or reserve governed by a specific provision in our merchant agreement?
5. 5What documentation would support remediation or resolve the review?
6. 6What is the appeal or escalation process if account information is inaccurate?
7. 7Are you evaluating services, memberships, products, prescriptions, fulfillment, recurring billing, disputes, or another category?
8. 8What current release conditions, fees, thresholds, or timelines should we confirm with the acquirer?

Bottom line

A payment processor reviewing a med spa account does not have one universal federal explanation. Start with the notice, deadline, merchant agreement, business description, licensing records, recurring-billing evidence, transaction history, and data-flow map. Respond consistently, ask the acquirer precise questions, and treat state-specific and healthcare-compliance issues separately from processor approval.

Explore how MDLaunchr and WhiteLabelClinic.com can support a compliance-first telehealth launch.

Related reading: Vagaro Payments Alternatives for Prescribing Practices, Boulevard Payments Alternatives for Prescribing Practices.